Where your data lives, and who can see it
Zhujian keeps your data on your own devices. Here are the facts up front, and what the sync server can see once you turn sync on.
- Where your data is
- In a SQLite database on your own device. Everything works offline; synced devices catch up when they reconnect.
- Account
- No sign-up. For multi-device sync, tap Create account; no email or phone number, nothing to write down. The account key lives only on your own devices; the server never has it.
- Sync
- Optional, end-to-end encrypted. Notes and images are encrypted on your device before they leave; the server only ever handles ciphertext and cannot read it. It is not a backup; recovery relies on your own devices. Two devices on the same Wi-Fi sync directly, without the server; others on that network cannot read the content, though they can tell the two are syncing.
- Analytics
- No analytics. With sync off, builds downloaded from zhujian.app only contact zhujian.app, to check for new versions; store builds leave updates to the store and contact nothing at all.
- AI
- None. It does not file or rewrite anything for you; the early version had some, and that code was removed.
- Free and open source
- Free to use, multi-device sync included. Open source (MIT), code on GitHub.
What it can see, and what it can't
With sync on, your data passes through a server. Here is the list, straight from the protocol.
Cannot see
- The text of your notes and tasks, and their earlier versions
- Images
- Tag names, board column names, device names
- Whether a change was a create, an edit, or a delete
- Your account key
Can see
- Account and device IDs (random strings) and each device's public key
- Which device is online, and when
- When data was sent and how much. From that it can guess roughly when you use the app
- The IP address a connection comes from
On disk the server keeps only these: account and device IDs with their public keys, which devices have admin rights, the account's device quota, the ban list, traffic metering, and connection logs with no content. While a device is offline, encrypted messages for it wait in server memory; they are dropped after 72 hours or when the server restarts. The data itself lives on your devices and catches up once they are back online.
One thing the protocol cannot cover: you have to trust that the installer you got was built from the open-source code on GitHub. If you would rather not, you can build it yourself.